I recommend using rspamd

ok thanks will check out rspamd ..

I use the combination of Defender, ClamAV and Cyren AV

I had issues with many false positives from Defender...

The best approach is multi-layered. 

As an aside, if you get false positives or false negatives with Cyren, you can use the Mark as Junk or Move to Inbox buttons in webmail. Those will report FN/FP (respectively) directly to Cyren. We don't need to manually send reports anymore. 

We used Cyren (CommTouch then) for for years but became unhappy with the performance. We switched to Message Sniffer which has been excellent and we haven't looked back. Derek, does the "Mark as Junk" button have the same reporting feature for Message Sniffer?

@Matthew - currently it doesn't, and I'm not sure Message Sniffer has a way to report them automatically. To be honest, we receive very few FP/FN reports for Message Sniffer. (Not that we receive a lot for Cyren, either, though.)

What values do you suggest for these Cyren IP Reputation settings?

Good Weight (currently its 0)

Low Weight (currently its 0)

Medium Weight (currently its 5)

High Weight (currently its 10)

Also, if spool filtering is not enable, does that means its doing nothing?

Thanks,

Most of our SmarterMail users use Declude and Message Sniffer. Message Sniffer has 2 options.. built into SmarterMail or the external version which can be used in conjunction with Declude and depending on your server's telemetry, you may qualify for reduced SOHO or SMB pricing with the external version. Hope this helps.